Listen to this Post
The vulnerability exists in the `isRemoteAllowed()` function within Astro’s Cloudflare adapter. This function is responsible for validating if a URL provided to the `/_image` endpoint is permitted for processing. The function correctly checks configured remote domains. However, a critical flaw exists where it explicitly and unconditionally returns `true` for any URL using the `data:` protocol. This bypasses all other security restrictions. When a malicious `data:` URL containing an SVG with embedded JavaScript is submitted, the image endpoint processes it. If the endpoint implementation does not convert the SVG to a safe raster format (like PNG) and instead serves the raw SVG back to the client browser, the embedded JavaScript code will execute within the context of the vulnerable domain, leading to a successful Cross-Site Scripting (XSS) attack.
Platform: Astro (Cloudflare Adapter)
Version: <=12.6.10
Vulnerability: XSS
Severity: Critical
date: 2024-12-17
Prediction: Patch by 2024-12-27
What Undercode Say:
curl -X GET "https://vulnerable-app.pages.dev/_image?url=data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'></svg>"
// Malicious SVG Payload const svgPayload = <code>data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)"></svg></code>;
How Exploit:
Craft a `data:` URL with a malicious SVG. Submit this URL to the vulnerable `/_image` endpoint. The endpoint returns the unsanitized SVG, causing script execution in the victim’s browser.
Protection from this CVE
Update to a patched version of `@astrojs/cloudflare` where the `isRemoteAllowed` function no longer unconditionally allows `data:` URLs. Implement strict Content Security Policy headers.
Impact:
Stored XSS, session hijacking, account takeover, data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
